HackMD
Assembly analysis for override pt 2
level08
main
Sets up stack frame and allocates 176 bytes for the stack. Store the initial value of edi argc? in [rbp-0x94] aka argc_stack and rsi argv? in [rbp-0xa0] aka argv_stack
store 40 in [rbp-0x8] aka count and clears eax
Store 0xff in [rbp-0x71] aka currchar, compare argc with 0x2. If it is equal, dont log usage. If not, load argv_stack[0] and call printf("Usage: %s filename", argv[0]). call fopen("/backups/.log", "w"). Move the return value to [rbp-0x88] aka logfile and compare it with 0. If its not equal, jump to 400a91. else, printf("ERROR: Failed to open %s", "/backups/.log"); and exit(1)
Load argv_stack[1] into rdx, call log_wrapper(logfile, "Starting back up:", argv_stack[1]) and call fopen(argv_stack[1], "r")and save the result at [rbp-0x80] aka inputfilestream . If its not null, jump to 400b09 , if it is, printf("ERROR: Failed to open %s", argv_stack[1]) and `exit(1)
Load "./backups/" into [rbp-0x70] aka prefix, load a buffer at [rbp-0xa8] aka dest set up args and call strcpy(dest, prefix) and strncat(prefix, argv[1], 99 - strlen(prefix) - 1).
call open(prefix, O_CREAT | O_EXCL | O_WRONLY, S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP). Saves the fd at [rbp-0x78] aka backupfile and check if greater than 0. If not, printf("ERROR: Failed to open %s%s\n", "./backups/", argv_stack[1]) and exit(1). If it is, jump to 400bed (loop check)
Call write(backupfile, currchar, 1) and jump to 400bee. at 400bee, load inputfielstream and call fgets(inputfilestream) and save result to currchar. Compares it with 0xff (EOF). If they are equal, exit the loop.
derefrence argv_stack[1] into rdx and call log_wrapper(logfile, "Finished back up", argv_stack[1]). close fclose(inputfilestream) and close(backupfile) and return.
log_wrapper
Setus up stack and allocates 304 bytes for the stack. Load arg1 at [rbp-0x118] aka logfile, arg2 at [rbp-0x120] aka string, arg3 at [rbp-0x128] aka inpfile_path. write 40 to [rbp-0x8] aka count. Load a new variable at [rbp-0x110] aka dest, call strcpy(dest, string).
Prepare arguments to call snprintf(dest + strlen(dest), 254 - strlen(dest) - 1, inpfile_path) and then calls dest[strcspn(dest, "/n")] = 0
Call fprintf(logfile, "LOG: %s", dest) and returns.
level09
main
Load a string and calls
calls handle_msg() and returns 0;
handle_msg
Sets up stack and allocates 192 bytes on the stack. Loads a variable at [rbp-0xc0] aka var1, increments the pointer to [rbp-0x34] (c0 - 8c), sets [rbp-0x34], [rbp-0x34+0x8], [rbp-0x34+0x10], [rbp-0x34+0x20] to 0, and writes 140 to [rbp-0xc] aka num. Since this is a 64 bit program, a word is 8 bytes so we can assume that [rbp-0x34] to [rbp-0xc] are contigious zeroes memset([rbp-0x34], 0, 40).
Since the assembly only loaded one address from memory and assigns values relatively, we can also say that they are loading a struct like so
calls set_username(&var1) and set_msg(&var1) and call puts(">: Msg sent!")
set_username
Allocates 160 bytes on the stack, loads argument1 &var1 at [rbp-0x98] and loads variable [rbp-0x90] aka temp. call memset(temp, 0, 16) and call
Call fgets(temp, 120, stdin), store 0 at a variable at [rbp-0x4] aka count and jump to a6a (loop check)
In a6a, count is compared to 40. If its greater than 40, or temp[count] is not 0, the loop exits.
In the loop at a44, do var1->username[count] = temp[count] and ++count
Once the loop exits at a81, call printf(">: Welcome, %s", var1->username) and return.
set_msg
Allocate 1040 bytes to the stack, loads argument1 &var1 at [rbp-0x408] and loads variable at [rbp-0x400] aka *temp. Call memset(temp, 0, 128) then puts(">: Msg @Unix-Dude") and printf(">>: ").
Call fgets(temp, 1024, stdin) and strncpy(var1->message, temp, var1->msglen) and return.
secret_backdoor
Loads a variable at [rbp-0x80] aka cmd and calls fgets(cmd, 128, stdin) and then system(cmd)
notes
7WJ6jFBzrcjEYXudxnM3kdW7n3qyxR6tk2xGrkSC
